Reference:
New Microsoft 365/Azure AD tenants enable Security defaults by default. The SC-300 materials emphasize that Security defaults and Conditional Access cannot be used together; to create and enforce custom Conditional Access policies (for example, requiring MFA under specific conditions), you must turn off Security defaults first. After disabling Security defaults, you can define Conditional Access policies that target specific users, apps, locations, or device states, and require controls such as MFA or session restrictions.
Disabling user consent, configuring on-premises password protection, or merely creating an MFA registration policy do not enable Conditional Access; they address different capabilities. Therefore, the first step to control access with Conditional Access is to disable Security defaults.

According to the official Microsoft Identity and Access Administrator (SC-300) Study Guide and the Azure Active Directory documentation under "Enable and configure self-service password reset (SSPR)", when self- service password reset is enabled, the available authentication methods depend on the user's role within Azure AD. Specifically, administrative roles require stronger authentication methods than regular users.
The Microsoft documentation states:
"Security questions are available only to users who are not administrators. Any user assigned an administrative role must use secure authentication methods such as email, mobile app, or phone verification." This restriction ensures that privileged accounts (e.g., User Administrator, Password Administrator, Global Administrator, Security Administrator, etc.) use stronger, phishing-resistant recovery options.
In the provided table:
* User1 (User Administrator) and User2 (Password Administrator) are administrators - they cannot use security questions for SSPR.
* User3 (Security Reader) and User4 (User) are non-administrative roles, therefore, they can use security questions when resetting their passwords.
Hence, only User3 and User4 will be required to answer security questions during password reset.

Microsoft Graph permissions can be of two types: Delegated and Application.
* Delegated permissions require a signed-in user and can access only that user's data.
* Application permissions are used by background services or daemons to access data across the organization without user consent if the app is granted admin consent.
In the scenario:
* App1 (User1) uses Delegated # can access only the user's data.
* App2 (User2) uses Delegated and Application (Calendars.ReadWrite) # can create appointments across all users. However, User2 has no role to grant consent for application-level permissions.
* App3 (User3, User4) uses Application (Calendars.Read) # only read, not write permissions.
Since User3 is an Exchange administrator, they have the authority to grant admin consent to an application.
Although App3 only has "Read," the Exchange administrator can manage calendar data organization-wide and can create appointments using Exchange management tools.
Hence, as per Microsoft's permissions model and SC-300 guidance, User3 is the only user who has both role and access capabilities to create appointments in every user's calendar.

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/roles/delegate-app-roles According to the Microsoft SC-300: Identity and Access Administrator Study Guide and the Microsoft Learn module "Manage application registrations in Azure AD," the ability to register applications in Azure Active Directory is controlled by the tenant-level setting "Users can register applications" found under User settings
# App registrations.
When this setting is set to No, only specific roles with app registration permissions can create or manage app registrations. To follow the principle of least privilege, the appropriate role should grant only the ability to register applications - not broader administrative capabilities.
The roles with permissions related to application registration include:
Application Developer - allows users to register and manage applications they own. This role is specifically designed for users who need to create app registrations when the tenant setting is disabled.
Cloud Application Administrator and Application Administrator - provide broader privileges, including managing all applications, credentials, and permissions, which exceed the minimum needed for this scenario.
Managed Application Contributor and App Configuration Data Owner - are Azure resource-level roles and have no relevance to Azure AD application registration.
From Microsoft documentation:
"If 'Users can register applications' is set to No, assign the Application Developer role to users who need to register apps." Therefore, to allow Admin1 to register App1 while adhering to the principle of least privilege, assign the Application Developer role.

As per the Microsoft SC-300 Study Guide and Azure Key Vault documentation , when you enable a system- assigned managed identity for a resource (in this case, Automation1), that identity can be granted permissions to specific Key Vault resources using Azure role-based access control (RBAC) .
Since the requirement states that Automation1 must be able t o read only one secret (Secret1) and not other secrets in the vault, you must assign permissions at the Secret level - not at the vault level. Assigning permissions at the Vault1 level (option A) would potentially allow access to all secrets, violating the principle of least privilege .
Therefore, you must go to Secret1 # Access control (IAM) and assign the Key Vault Secrets User role (or similar least-privileged role) to the system-assigned identity of Automation1 .
This aligns with Microsoft's documentation :
"To restrict access to individual secrets or keys, use Azure role assignments at the specific secret, key, or certificate level rather than the vault level."